In Wi-Fi networking applications, security features have gradually evolved to provide more robust and better-integrated security tools. In the EAP (Extensible Authentication Protocol) standard of 802.11i, promulgated by the Institute of Electrical and Electronics Engineers (IEEE), an authentication technique including a mechanism referred to as a “4-way handshake” can be used. In the 4-way handshake mechanism, a client device such as a laptop computer, smart phone, or other client device, generally referred to as a “station,” negotiates with a wireless router or other device, generally referred to as an “access point,” to establish a secure networking session. During the session, the station may seek a connection to the Internet or other networks.
In the 4-way handshake approach, the station and access point exchange a series of four defined messages, based on which mutual authentication can be carried out. The access point can interact with a remote authentication dial in user service (RADIUS) server or other authentication server, a platform, or a service to establish a set of shared secrets and/or public and private keys that are used by the station and access point to execute the 4-way handshake procedure. As part of the 4-way handshake procedure, the station and access point can access a shared secret, which can include a pair-wise master key (PMK). Messages exchanged between the station and the access point can be encoded using further sets of public and private keys, including a transient pairwise key (PTK), which can be constructed using the pair-wise master key as a generator for further encryption key layers.
However, in existing 4-way handshake embodiments, an attacker who is able to successfully intercept and decode the pair-wise master key may then be able to use that higher-level key to generate and possibly intercept and decode traffic between the access point and one or more stations by generating or deducing the respective pair-wise transient keys or other cipher information, because once a pair-wise master key is established, the additional session keys derived from that pair-wise master key remain valid and operable for as long a time as the original pair-wise master key remains valid. As a result, a successful attacker who captures the pair-wise master key may be able to decrypt the streams between the access point and any one or more stations that communicate with the access point during the effective lifetime of the pair-wise master key.